RuoyiScanX

Ruoyi-Scan — A specialized vulnerability scanner by RuoYi !...

CVE-2026-100861: Server-Side Request Forgery (SSRF)

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-89136: Improper Authentication

When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...

CVE-2026-100858: Server-Side Request Forgery (SSRF)

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

Logpresso Log4j2 Scanner 3.0.2

Logpresso Log4j2 Scanner version 3.0.2 scans archives recursively for vulnerable Log4j components, including CVE-2021-44228, and can optionally back up and remove vulnerable classes...

CVE-2026-94408: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

CVE-2026-94398: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

CVE-2026-94400: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Kibana can lead denial of service via Excessive Allocation CAPEC-130...

Karma Pro 0.11

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

CVE-2026-94397: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

modbus-scanner

Modbus Detection Scanner A multithreaded C scanner for detecting Modbus/TCP services using libmodbus. The scanner does not rely only on TCP port 502 being open. Instead, it establishes a Modbus/TCP connection and sends an application layer Modbus request. A valid Modbus response is used as the...

XXERipper

XXERipper A standalone, black-box XML External Entity XXE...

DroidSniper

DroidSniper - Misconfigured Android Debug Bridge Scanner 🎯 This tool, DroidSniper, is designed to detect misconfigured Android Debug Bridge ADB protocols on Android devices. These devices are vulnerable to unauthorized access via ADB due to misconfiguration. By scanning for ADB instances lacking...

LiquidNet

LiquidNet 🌐🔍 LiquidNet is an IPv4 grabber/scanner designed to help pentesters gather IP addresses/global targets worldwide. This tool empowers security professionals to identify potential vulnerabilities across networks. Features 🛠️ IPv4 Gathering: Quickly and efficiently gather IP addresses...

CVE-2026-78902: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package...

CVE-2026-52622: Exposure of Sensitive Information to an Unauthorized Actor

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-88378: Out-of-bounds Write

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

CVE-2026-93213: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

CVE-2026-51996: Use of Weak Hash

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...